Application Assessments and Penetration Testing DSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a key characteristic of an effective security assessment report?

   • AIt is generated only after a security incident
   • BIt contains as much technical detail as possible for all readers
   • CIt clearly communicates risks and remediation steps to stakeholders
   • DIt only lists vulnerabilities without context
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security team is integrating penetration testing into a CI/CD pipeline for a critical financial application. They have a limited budget and cannot afford manual pen tests on every build. They also need to comply with a regulation that requires an annual full-scope pen test. What is the most cost-effective strategy that still meets compliance?

   • ARun a full manual pen test on every release candidate and skip automated scans.
   • BRun only automated DAST and claim it satisfies the annual pen test requirement.
   • CRun automated DAST on every build and schedule a full manual pen test annually before the compliance deadline.
   • DPerform a manual pen test only after a security incident.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A company is planning to conduct a security assessment of their web application. They want to identify vulnerabilities in the source code and also test the running application for issues like misconfigurations. Which combination of assessment types should they use?

   • ADAST and penetration testing
   • BSAST and DAST
   • CSAST and SCA
   • DIAST and SCA
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which of the following is a typical output of an SCA scan?

   • AA list of network ports open on the production server
   • BA list of open-source components with known CVEs and license types
   • CA performance benchmark of the application under load
   • DA report of SQL injection vulnerabilities found in the source code
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is the purpose of orchestrating the outputs of multiple security testing tools?

   • ATo consolidate results into a single view and reduce false positives
   • BTo slow down the pipeline for thorough testing
   • CTo replace the need for human security analysts
   • DTo increase the number of vulnerabilities reported
   Reveal Solution Discussion Select an answer first